CVE-2025-23013: pam-u2f: problematic PAM_IGNOturn values in pam_sm_authenticate() (CVE-2025-23013)
First published: Wed Jan 15 2025(Updated: )
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support authentication using a YubiKey or other FIDO compliant authenticators on macOS or Linux. This software package has an issue that allows for an authentication bypass in some configurations. An attacker would require the ability to access the system as an unprivileged user. Depending on the configuration, the attacker may also need to know the user's password.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Yubico PAM U2F | <1.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.yubico.com/support/security-advisories/ysa-2025-01/
- http://www.openwall.com/lists/oss-security/2025/01/15/1
- http://www.openwall.com/lists/oss-security/2025/01/16/2
- http://www.openwall.com/lists/oss-security/2025/01/16/3
- http://www.openwall.com/lists/oss-security/2025/01/16/4
- http://www.openwall.com/lists/oss-security/2025/01/16/5
- https://lists.debian.org/debian-lts-announce/2025/02/msg00001.html
Frequently Asked Questions
What is the severity of CVE-2025-23013?
CVE-2025-23013 has a moderate severity rating due to the potential for local privilege escalation.
How do I fix CVE-2025-23013?
To mitigate CVE-2025-23013, upgrade Yubico pam-u2f to version 1.3.1 or later.
What systems are affected by CVE-2025-23013?
CVE-2025-23013 affects Yubico pam-u2f versions prior to 1.3.1 on macOS and Linux.
Can CVE-2025-23013 be exploited remotely?
No, CVE-2025-23013 requires local access to exploit the privilege escalation.
What impact does CVE-2025-23013 have on my system?
CVE-2025-23013 could allow an attacker with local access to gain elevated privileges on the system.
- agent/type
- agent/description
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/author
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-23013
- agent/title
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/event
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/references
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/yubico
- canonical/yubico pam u2f